Uncontrolled Memory Allocation in libheif - #VU146731
Published: September 2, 2026
Vulnerability identifier: #VU146731
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-789
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled memory allocation in ExifTags::Parse in the TIFF decoder when parsing a crafted TIFF file with an EXIF tag length value that lacks an upper bound. A remote attacker can send a specially crafted TIFF file to cause a denial of service.
The malicious EXIF tag is parsed after the image decodes successfully, and multiple oversized tag lengths can accumulate memory consumption.
Affected software
libheif
Remediation
Install security update from vendor's website.
libheif - update to 1.23.3